CVE-2016-1252

Опубликовано: 05 дек. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

Ссылки

http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html
Issue Tracking
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3156-1
Third Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1020
Exploit
Issue Tracking
Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467
Exploit
Issue Tracking
Third Party Advisory
https://www.debian.org/security/2016/dsa-3733
Issue Tracking
Vendor Advisory
https://www.exploit-db.com/exploits/40916/
Exploit
Issue Tracking
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html
Issue Tracking
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3156-1
Third Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1020
Exploit
Issue Tracking
Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467
Exploit
Issue Tracking
Third Party Advisory
https://www.debian.org/security/2016/dsa-3733
Issue Tracking
Vendor Advisory
https://www.exploit-db.com/exploits/40916/
Exploit
Issue Tracking
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:*

Версия до 1.0.9.8.4 (исключая)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05955

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

CVE-2016-1252

CVSS3: 5.9

ubuntu

около 8 лет назад

CVE-2016-1252

CVSS3: 5.9

debian

около 8 лет назад

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable ...

GHSA-53rm-7gr9-9hfx

CVSS3: 5.9

github

больше 3 лет назад

EPSS

Процентиль: 90%

0.05955

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295